Heap Out-of-Bounds Write Vulnerability in GStreamer by Red Hat

CVE-2026-19387

What is CVE-2026-19387?

A heap out-of-bounds write vulnerability was identified in the GStreamer gst-plugins-bad adpcmdec element during the decoding process of IMA/DVI ADPCM audio. This security flaw stems from insufficient validation of the per-block sample count, particularly for multi-channel streams. An attacker could exploit this by delivering a specially crafted WAV file, leading to writes that exceed the bounds of the allocated output buffer. The potential consequences include application crashes, denial of service incidents, memory corruption, and in certain cases, arbitrary code execution when processing untrusted media.

References